FTP Logs

This page explains the FTP Logs screen in GoAdmio. It shows FTP connection and transfer activity across all domain accounts on the server, so you can audit file transfers, detect brute-force attempts, and investigate suspicious uploads.

Location: Admin Panel → Files & FTP → FTP Logs
Location (User Panel): Files & FTP → FTP Logs (scoped to the account, if enabled)

Overview

GoAdmio runs VSFTPD as its FTP server. Every FTP connection — successful or failed, upload or download, delete or rename — is recorded in the server's transfer and authentication logs. The FTP Logs page surfaces that activity in a readable, searchable view.

Unlike the User Panel view (which shows only the account's own FTP activity), the Admin Panel view shows logs for every domain and every FTP user on the server in one place. This makes it the right tool for:

Security auditing — spotting failed login attempts and brute-force patterns
Investigating incidents — tracing which account uploaded a suspicious file and when
Compliance — providing a record of file transfer activity
Support diagnostics — confirming whether a customer's FTP client is connecting at all
Capacity planning — seeing which accounts transfer the most data

> Note: The exact log format depends on the VSFTPD configuration. GoAdmio reads the standard log files (/var/log/xferlog, /var/log/vsftpd.log, and syslog entries) and displays them in a unified view.

What the Page Shows

| Column / Field | Description |
|---|---|
| Timestamp | When the event occurred |
| Domain / Account | The hosting account associated with the FTP user |
| FTP User | The FTP login (e.g., developer@example.com) |
| Action | The event type: CONNECT, LOGIN, UPLOAD, DOWNLOAD, DELETE, RENAME, FAILED LOGIN, DISCONNECT |
| File / Path | The file or directory involved (for transfer actions) |
| Size | Bytes transferred (for upload/download) |
| Duration | Transfer time (for completed transfers) |
| Source IP | The IP address the FTP client connected from |
| Status | OK, FAILED, DENIED, TIMEOUT |

> Tip: The Source IP and Status columns are the most useful for security work. Repeated FAILED LOGIN entries from the same IP are the clearest sign of a brute-force attempt.

How to Use FTP Logs

View recent activity

Log in to the GoAdmio Admin Panel.
Navigate to Files & FTP → FTP Logs.
The page shows recent FTP activity, newest first.

Filter and search

Use the filters to narrow the view:

| Filter | Purpose |
|---|---|
| Domain / Account | Show only FTP activity for one hosting account |
| FTP User | Show only activity for a specific FTP login |
| Action | Show only uploads, only failed logins, only deletes, etc. |
| Source IP | Find all activity from a specific IP |
| Date range | Limit to a time window |
| Status | Show only failed or denied events |

> Tip: Filter by Status = FAILED to surface brute-force attempts and misconfigured clients in one view.

Investigate a specific event

Locate the event in the list.
Note the FTP User, Source IP, Timestamp, and Path.
Correlate with:

- The File Manager — confirm the file's current state - IP Blocker — block the source IP if malicious - ClamAV Antivirus — scan uploaded files - Backup Wizard — restore files if they were tampered with

Log File Locations

The FTP Logs page reads from the server's standard log files. On the command line:

| File | Contents |
|---|---|
| /var/log/xferlog | Classic FTP transfer log — uploads, downloads, deletes, renames |
| /var/log/vsftpd.log | VSFTPD-specific connection and authentication log |
| /var/log/messages or /var/log/syslog | Syslog entries including FTP authentication events |
| /var/log/secure (RHEL) or /var/log/auth.log (Debian) | Authentication failures and successes |

View the logs directly

```bash

Recent FTP transfers

tail -n 100 /var/log/xferlog

Connection and auth events

tail -n 100 /var/log/vsftpd.log

Failed logins across the system

grep -i "vsftpd.*fail" /var/log/messages grep -i "vsftpd" /var/log/auth.log